{"record":{"id":"c0e4683e6d520e0a","repo":"dotnet/wpf","slug":"sr-unsupportedhashalgorithm","errorCode":null,"errorMessage":"SR.UnsupportedHashAlgorithm","messagePattern":"SR\\.UnsupportedHashAlgorithm","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":773,"sourceCode":"                    _signedXml.SignedInfo.SignatureMethod = SelectSignatureMethod(key);\n                }\n\n                // Track if we are matching the signature method in order to retry on failure\n                bool usingMatchingSignatureMethod = _signedXml.SignedInfo.SignatureMethod != null;\n\n                // put it in the XML\n                if (embedCertificate)\n                {\n                    _signedXml.KeyInfo = GenerateKeyInfo(key, signer);\n                }\n\n                // Package object tag\n                // convert from string to class and ensure we dispose\n                using (HashAlgorithm hashAlgorithm = GetHashAlgorithm(_hashAlgorithmName))\n                {\n                    // inform caller if hash algorithm is unknown\n                    if (hashAlgorithm == null)\n                        throw new InvalidOperationException(SR.UnsupportedHashAlgorithm);\n\n                    _signedXml.AddObject(GenerateObjectTag(hashAlgorithm, parts, relationshipSelectors, signatureId));\n                }\n\n                // add reference from SignedInfo to Package object tag\n                Reference objectReference = new Reference(XTable.Get(XTable.ID.OpcLinkAttrValue))\n                {\n                    Type = XTable.Get(XTable.ID.W3CSignatureNamespaceRoot) + \"Object\",\n                    DigestMethod = _hashAlgorithmName\n                };\n                _signedXml.AddReference(objectReference);\n\n                // add any custom object tags\n                AddCustomObjectTags(signatureObjects, objectReferences);\n\n                // compute the signature\n                SignedXml xmlSig = _signedXml;\n","sourceCodeStart":755,"sourceCodeEnd":791,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L755-L791","documentation":"During PackageDigitalSignatureManager.Sign, the requested hash algorithm name is resolved via GetHashAlgorithm; if it returns null the algorithm is unsupported and an InvalidOperationException(SR.UnsupportedHashAlgorithm) is thrown. OPC signing only supports a fixed set of hash algorithms on the current platform.","triggerScenarios":"Calling PackageDigitalSignatureManager.Sign with a hashAlgorithmName string that GetHashAlgorithm cannot map to a HashAlgorithm instance on the running machine (e.g. \"SHA256\" on a platform/FIPS mode without the provider, or a typo/unsupported name like \"SHA3\").","commonSituations":"Signing on FIPS-compliant machines where certain algorithm implementations are disabled; targeting .NET runtimes or OS versions lacking the requested CSP; user-supplied algorithm names from configuration files.","solutions":["Use a supported hash algorithm name (e.g. \"SHA1\"/\"SHA256\" per OPC support) when calling Sign.","Check the algorithm in advance by instantiating HashAlgorithm.Create(name) and validating it is non-null before signing.","If FIPS mode blocks the algorithm, enable the corresponding FIPS-certified provider or switch to a FIPS-approved algorithm (e.g. SHA256).","Validate configuration-supplied algorithm names against a whitelist at startup."],"exampleFix":"// before\ndsm.HashAlgorithm = \"SHA384\"; // not resolvable on this machine\ndsm.Sign(parts);\n// after\ndsm.HashAlgorithm = \"SHA256\"; // supported\ndsm.Sign(parts);","handlingStrategy":"validation","validationCode":"bool hashSupported = false;\nusing (var h = HashAlgorithm.Create(hashAlgorithmName)) { hashSupported = h != null; }","typeGuard":null,"tryCatchPattern":"try { dsm.Sign(parts); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"HashAlgorithm\")) { /* fall back to a supported algorithm */ }","preventionTips":["Whitelist hash algorithm names in configuration","Test signing on FIPS-enabled machines","Pre-resolve the algorithm with HashAlgorithm.Create before Sign"],"tags":["wpf","signatures","hash-algorithm","cryptography"],"backgroundTag":"unsupported-enum-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}